CVE-2020-12017 Auth bypass in GE Grid Solutions Reason RT Clocks
Unauthenticated attackers can bypass authentication to execute arbitrary commands, change passwords, and reboot GE industrial RT clocks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12017?
CVE-2020-12017 is a critical authentication bypass vulnerability in GE Grid Solutions Reason RT Clocks, published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
Weakness: CWE-306
Which versions are affected by CVE-2020-12017?
It affects 3 products.
Products include Ge Rt430 Firmware, Ge Rt431 Firmware, Ge Rt434 Firmware.
How do I fix CVE-2020-12017?
No fix has been published for CVE-2020-12017 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-12017 being exploited?
There is no known exploitation of CVE-2020-12017 in the wild and no public exploit code.
Other vulnerabilities in GE Grid Solutions Reason RT Clocks
Sources
Also known as GHSA-29xh-89xf-762p.